The National Advertising Initiative: TRUSTe’s Systematic March From NAI Transparency

Report home | Read the report (PDF) | Previous section | Next section

TRUSTe began reporting on NAI complaints in March 2002. It used its Watchdog Reports to do this. In the intervening years, TRUSTe public reports regarding the NAI reveal a troubling, systematic reduction of transparency regarding the NAI. (See Appendix B for a complete listing of all TRUSTe NAI complaints.)

In its first stage of reporting, for 10 months from March 2002 to December 2002, TRUSTe reported the total number of incoming NAI complaints, and it segmented those incoming complaints by grouping complaints about opt-out cookies and complaints about online preference marketing, among some other categories. (See Figure 5.) The resolution of NAI complaints was also included in the Watchdog Reports. So for example, in March 2002 anyone could see that 30 NAI complaints came in, and 30 of the complaints were about opt-out cookies. While this is not highly granular reporting, this reporting at least gave the public an ability to monitor what complaints were coming in, and in what areas.

Figure 5:
A screenshot of the March 2002 report of 30 NAI opt-out cookie complaints. Note that incoming complaints are monitored. (Highlighting added for emphasis)

In the second stage of TRUSTe’s NAI reporting, beginning January 2003, TRUSTe stopped reporting on any incoming NAI complaints. For a period of 24 months, from January 2003 – December 2004, TRUSTe only reported on the total number of NAI complaints that were resolved, thus reducing the transparency of the reporting. (See Figure 6). TRUSTe still reported on how many opt-out cookie and OPM complaints were resolved. But there was no more information on incoming complaints. This was an inappropriate step away from transparency.

Figure 6:
A screenshot of the December 2004 TRUSTe reporting format. Note that complaints are of privacy issues resolved. (Highlighting added for emphasis)

TRUSTe’s reporting continued to devolve toward less transparency. In its third NAI reporting stage, beginning in January 2005 (TRUSTe became a member of the NAI organization in 2005 for a period of one year) and continuing until August of 2006, TRUSTe stopped reporting on anything other than the total number of NAI disputes that were resolved. (See Figure 7). For a period of 20 months, TRUSTe did no more reporting on incoming disputes, no more reporting on opt-out cookie complaints, and no more reporting on NAI OPM complaints.

Figure 7:
TRUSTe begins reporting only the total NAI privacy issues resolved (2005- August 2006). (Highlighting added for emphasis)

Then finally, in September 2006 until the current time, TRUSTe no longer reports publicly on the NAI complaints whatsoever in its Watchdog Reports. There is no longer any category available in the TRUSTe Watchdog Reports for NAI-related complaints. It is unknown why TRUSTe moved systematically stepwise away from transparency, but the Watchdog Reports speak for themselves.

Figure 8:
Screenshot of TRUSTe’s current report format. There is no specific reporting about the NAI in the WatchDog reports.

It is implausible to think that NAI complaints ceased, and there was nothing to report. From March 2002 to August 2006, the last month that TRUSTe reported NAI complaints, each and every month’s Watchdog Reports listed NAI complaints that had been received, save for one month. In December 2005 there were 66 NAI disputes. Are we to believe that in December of 2006, one year later, there were zero disputes and that is why the category was omitted entirely? After nearly 5 years of monthly NAI complaints, it seems unlikely that the NAI complaints evaporated without a trace. Even if that were the case, TRUSTe could have reported zero complaints.

Appendix B lists the complete public history of the NAI complaints as handled by TRUSTe.

Is TRUSTe Really Independent?

It is difficult to reconcile the statement of the NAI that TRUSTe is an independent enforcement program, when TRUSTe was a member of the organization it was the enforcement mechanism for in 2005. It is wholly inappropriate for an independent overseer to be a member of an organization that it is overseeing.

Where Are the Audits?

The NAI agreement states that either the member organizations must submit to an independent seal program that conducts random audits, or they must undergo independent audits. There is no information showing whether TRUSTe actually conducted random audits.

If TRUSTe conducts independent audits of NAI members, an auditing methodology should be published for transparency. Nothing is known about auditing by TRUSTe, and the lack of information undermines the credibility of both TRUSTe and NAI. Nothing on the public record suggests that TRUSTe actually conducted any of the required audits.

Enforcement of NAI Sensitive Data Safeguards

The NAI agreement contains language that restrict NAI members from using certain types of information:

Sensitive Data: Network advertisers shall neither use personally identifiable information about sensitive medical or financial data, sexual behavior or sexual orientation, nor social security numbers for [Online Preference Marketing]. [73]

It is not clear how NAI members implement this limitation. First, what constitutes sensitive medical information? Some may believe that any information about health care constitutes sensitive medical information. Others may believe that the only sensitive medical information relates to HIV/AIDS, drug treatment, or issues related to mental health. Because the NAI agreement did not specify what constituted sensitive medical information, each company can decide for itself.

For example, Tacoda, in a press release announcing its Consumer Choice Initiative, noted, “Tacoda will avoid targeting advertisements using sensitive data, such as sexual preference, certain medical conditions, or identifying children. Current industry practices permit targeting on this type of data.” [74] What are “certain medical conditions”? Why do current industry practices allow targeting using types of data that appear to be expressly prohibited in the NAI agreement? If current industry practices permit targeting on this data, then the current industry practices have apparently not been touched by the NAI.

When NAI standards are unclear, it is impossible to hold members or the NAI accountable for compliance. This may account, in part, for the lack of audit information from TRUSTe.

_______________________________

Endnotes

[73] See Network Advertising Initiative, Self-regulatory Principles for Online Preference Marketing by Network Advertisers, July 10, 2000. < http://www.ftc.gov/os/2000/07/NAI%207-10%20Final.pdf>.

[74] Market Wire, Press Release. Tacoda Launches Consumer Choice Initiative; Plans Consumer Opt-Out Preservation with New Patent-Pending Technology, November 6, 2006.

Roadmap: The National Advertising Initiative – Failing at Consumer Protection and at Self-Regulation: Part II: Discussion – TRUSTE’s Systematic March From NAI Transparency

Report home | Read the report (PDF) | Previous section | Next section

Posted November 2, 2007 in Report: The National Advertising Initiative - Failing at Consumer Protection and at Self-Regulation, Uncategorized

New Report: Risky Analysis: Assessing and Improving AI Governance Tools

We are pleased to announce the publication of a new WPF report, “Risky Analysis: Assessing and Improving AI Governance Tools.” This report sets out a definition of AI governance tools, documents why and how these tools are critically important for trustworthy AI, and where these tools are around the world. The report also documents problems in some AI governance tools themselves, and suggests pathways to improve AI governance tools and create an evaluative environment to measure their effectiveness. AI systems should not be deployed without simultaneously evaluating the potential adverse impacts of such systems and mitigating their risks, and most of the world agrees about the need to take precautions against the threats posed. The specific tools and techniques that exist to evaluate and measure AI systems for their inclusiveness, fairness, explainability, privacy, safety and other trustworthiness issues — called in the report collectively AI governance tools – can improve such issues. While some AI governance tools provide reassurance to the public and to regulators, the tools too often lack meaningful oversight and quality assessments. Incomplete or ineffective AI governance tools can create a false sense of confidence, cause unintended problems, and generally undermine the promise of AI systems. The report contains rich background details, use cases, potential solutions to the problems discussed in the report, and a global index of AI Governance Tools.
National IDs Around the World — Interactive map

About this Data Visualization: This interactive map displays the presence...
Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process.